Feb 21, 2025
2 new incidents, 0 with updates.
Started
- ClosedCriticalNo fix needed
Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea)
North Korean TraderTraitor/Lazarus hackers compromised a Safe{Wallet} developer's Mac, took over AWS session tokens and injected JavaScript into Safe's S3-hosted frontend. Bybit's signers approved what looked like a routine transfer but was a malicious transaction. It is the largest crypto theft on record; the FBI attributed it to North Korea.
Bybit cold wallet / Safe{Wallet} web UIClosed Mar 6, 2025
- ClosedPatched
Microsoft Power Pages: Power Pages Improper Access Control Vulnerability
Microsoft Power Pages contains an improper access control vulnerability that allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. Added to CISA KEV on 2025-02-21.
Microsoft Power PagesClosed Feb 21, 2025
